EUVD-2026-64561
GHSA-3q82-j896-jqw7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AC:H reflects the non-default nfnetlink_log and conntrack-export configuration prerequisite; PR:N because the attacker only sends packets with no authentication needed.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack: defer invalid log until after unlock
TCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock is still held.
When invalid logging is routed to nfnetlink_log and conntrack export is enabled, the log path can re-enter conntrack netlink glue and dump the same conntrack again. Protocol attribute dumping may take ct->lock, so logging while holding that lock can deadlock.
Defer the TCP invalid logs by storing only the minimal log context while ct->lock is held and emitting the log after unlocking. Also make the TCP timeout-lowering invalid path return whether a log is needed, then emit that log after unlocking.
Do the same for the SCTP invalid state-transition log that can be reached while ct->lock is held.
Add a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers that log invalid conntracks while holding ct->lock are caught outside TCP and SCTP as well.
AnalysisAI
Deadlock in the Linux kernel's netfilter nf_conntrack subsystem can be triggered remotely by sending malformed TCP or SCTP packets when nfnetlink_log with conntrack export is active as the logging target. The logging emission path re-enters conntrack netlink glue code and attempts to re-acquire ct->lock already held by the conntrack processing path, causing a kernel deadlock and system-wide denial of service. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two non-default kernel configuration conditions active simultaneously: nfnetlink_log must be configured as the active logging target for netfilter invalid-packet events (e.g., via the NFLOG target in iptables or nftables rules pointing at a nfnetlink_log group), and conntrack attribute export must be enabled for that log group so the log-emission path attempts to dump the conntrack entry. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 7.5 HIGH score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a remotely accessible, unauthenticated denial-of-service path, but the AC:L rating overstates accessibility: the deadlock is only reachable when nfnetlink_log is the active conntrack logging target AND conntrack attribute export is enabled - both non-default settings requiring deliberate administrative configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access sends a stream of deliberately malformed TCP or SCTP packets to a Linux system whose firewall is configured with nfnetlink_log and conntrack export enabled. Each invalid packet causes the kernel to invoke the conntrack invalid-log path while holding ct->lock; that path re-enters conntrack netlink code and deadlocks attempting to re-acquire the same lock, halting kernel network processing and producing a system-wide denial of service. … |
| Remediation | The primary remediation is to upgrade the Linux kernel to a patched stable release appropriate for the running branch: 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2 and later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify production Linux systems using the vulnerable netfilter conntrack logging feature, particularly internet-facing systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today